C:\Users\jnerf\Desktop\ETHRAL_LAUNCHER\examples\example_win32_directx9\Release\example_win32_directx9.pdb
Static task
static1
Behavioral task
behavioral1
Sample
example_win32_directx9.exe
Resource
win10v2004-20240412-en
General
-
Target
example_win32_directx9.exe
-
Size
1.6MB
-
MD5
a293087d48eecb5c09b837acd5865070
-
SHA1
2412babf3875912468d11c35caba35e6cadc9380
-
SHA256
ffdc9ff13eb78eabb5af1081ce9ef79cd747abdfa0351e14b801aaa5ebb0a0d2
-
SHA512
d514db541fdf939a58eb3cf2b2349628a3170bfcb66f14bf8fcb77d6769ab769ff203982788140b462f5646a00c59b54f886de7bf1c02ae74d9d3d463e55838f
-
SSDEEP
24576:KbA3wn5aztz1lHfgQpxo60OegX7AoznRyoHOlCOrL31kJoCggTzTXKxHDIoK:Kt5Ab/0ErvznRyouIOrpLCga7KxjIf
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource example_win32_directx9.exe
Files
-
example_win32_directx9.exe.exe windows:6 windows x64 arch:x64
7e8887dec282c28d01d9bc22bd5648de
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
d3d9
Direct3DCreate9
kernel32
FormatMessageW
GetLastError
SetEvent
GetCurrentThread
TerminateThread
CloseHandle
FreeConsole
QueueUserAPC
LocalFree
DeleteCriticalSection
SleepEx
FormatMessageA
CreateIoCompletionPort
GetExitCodeProcess
InterlockedPushEntrySList
AreFileApisANSI
GetTempPathW
SetFileInformationByHandle
GetFullPathNameW
CreateFileW
EnterCriticalSection
GetLocaleInfoEx
TerminateProcess
InitializeSListHead
GetCurrentThreadId
Sleep
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
GetCurrentProcessId
DeviceIoControl
CreateFileA
LoadLibraryExA
VirtualAlloc
VirtualFree
K32GetModuleFileNameExW
LoadLibraryW
GetModuleHandleW
GetSystemTimeAsFileTime
CreateEventW
PostQueuedCompletionStatus
WaitForSingleObject
GetQueuedCompletionStatus
SetLastError
SetWaitableTimer
QueryPerformanceCounter
FreeLibrary
VerSetConditionMask
GetProcAddress
QueryPerformanceFrequency
LoadLibraryA
GetModuleHandleA
GlobalUnlock
WideCharToMultiByte
LeaveCriticalSection
RaiseException
GetFileAttributesW
GetEnvironmentVariableW
GetFileInformationByHandleEx
GlobalLock
GlobalFree
GlobalAlloc
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
SetThreadPriority
WaitForMultipleObjects
IsProcessorFeaturePresent
GetCurrentProcess
HeapFree
GetProcessHeap
HeapAlloc
user32
DefWindowProcA
SetClipboardData
GetDesktopWindow
LoadImageA
DispatchMessageA
GetWindowRect
DestroyWindow
SetWindowPos
GetClipboardData
CreateWindowExW
UnregisterClassW
RegisterClassExW
ShowWindow
MessageBoxA
UpdateWindow
GetKeyState
EmptyClipboard
CloseClipboard
EnumDisplaySettingsA
OpenClipboard
GetCursorPos
SetCursorPos
TranslateMessage
LoadCursorA
ScreenToClient
GetCapture
PostQuitMessage
ClientToScreen
TrackMouseEvent
GetForegroundWindow
SetCapture
MoveWindow
SetCursor
GetClientRect
SetProcessDPIAware
IsWindowUnicode
SendMessageA
PeekMessageA
ReleaseCapture
advapi32
RegQueryValueExA
LookupPrivilegeValueW
RegOpenKeyA
RegDeleteKeyA
RegSetValueExA
RegOpenKeyExA
AdjustTokenPrivileges
RegCloseKey
LookupPrivilegeValueA
GetUserNameA
OpenProcessToken
ConvertSidToStringSidW
GetTokenInformation
RegCreateKeyA
shell32
ShellExecuteExA
libcurl
curl_easy_setopt
curl_easy_cleanup
curl_easy_strerror
curl_easy_init
curl_global_cleanup
curl_global_init
curl_easy_perform
imm32
ImmSetCompositionWindow
ImmReleaseContext
ImmGetContext
ImmSetCandidateWindow
msvcp140
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?wcerr@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?_Winerror_map@std@@YAHH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAA_JPEB_W_J@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?__ExceptionPtrCopyException@@YAXPEAXPEBX1@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
??6?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV01@K@Z
?fail@ios_base@std@@QEBA_NXZ
?good@ios_base@std@@QEBA_NXZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
??Bid@locale@std@@QEAA_KXZ
?_Xbad_function_call@std@@YAXXZ
_Thrd_id
_Thrd_join
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?_Xlength_error@std@@YAXPEBD@Z
?__ExceptionPtrCreate@@YAXPEAX@Z
dwmapi
DwmExtendFrameIntoClientArea
ws2_32
ioctlsocket
htons
htonl
getsockopt
WSARecv
connect
WSAStartup
WSACleanup
closesocket
WSASend
select
ntohl
WSASetLastError
WSAStringToAddressW
WSAGetLastError
WSASocketW
setsockopt
d3dx9_43
D3DXCreateTextureFromFileInMemory
ntdll
NtQuerySystemInformation
RtlInitUnicodeString
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
RtlAnsiStringToUnicodeString
RtlInitAnsiString
dbghelp
ImageRvaToVa
ImageDirectoryEntryToData
ImageNtHeader
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__current_exception_context
__current_exception
memset
memcpy
_CxxThrowException
_purecall
__std_type_info_compare
__std_exception_copy
__std_exception_destroy
strstr
__std_terminate
memcmp
memchr
__C_specific_handler
memmove
api-ms-win-crt-stdio-l1-1-0
setvbuf
fgetpos
fgetc
_set_fmode
__stdio_common_vsnwprintf_s
_get_stream_buffer_pointers
__p__commode
__stdio_common_vsscanf
fread
_fseeki64
__stdio_common_vsprintf
_wfopen
fwrite
ungetc
fputc
__stdio_common_vfprintf
fseek
fclose
fflush
__acrt_iob_func
ftell
fsetpos
api-ms-win-crt-utility-l1-1-0
rand
qsort
api-ms-win-crt-string-l1-1-0
iswspace
_stricmp
strcmp
wcscat_s
strncpy
strncmp
api-ms-win-crt-heap-l1-1-0
malloc
_callnewh
free
_set_new_mode
api-ms-win-crt-runtime-l1-1-0
_c_exit
_wassert
__p___argv
__p___argc
_exit
_initterm_e
abort
_initterm
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_configure_narrow_argv
_invalid_parameter_noinfo
_cexit
_crt_atexit
terminate
system
_initialize_narrow_environment
_beginthreadex
_register_onexit_function
_errno
exit
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
api-ms-win-crt-convert-l1-1-0
wcstol
atof
api-ms-win-crt-math-l1-1-0
cosf
ceilf
acosf
__setusermatherr
fmodf
sqrtf
_dsign
sinf
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_mkdir
_lock_file
api-ms-win-crt-locale-l1-1-0
___lc_codepage_func
_configthreadlocale
localeconv
api-ms-win-crt-environment-l1-1-0
getenv
ole32
CoCreateGuid
CoCreateInstance
CoInitializeEx
CoUninitialize
PropVariantClear
CoTaskMemAlloc
oleaut32
SysStringLen
GetErrorInfo
SysAllocString
SetErrorInfo
SysFreeString
Sections
.text Size: 459KB - Virtual size: 458KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 391KB - Virtual size: 390KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 40KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 24KB - Virtual size: 23KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 723KB - Virtual size: 722KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ